Legal Discovery Tool Implemented In A Mobile Device

ABSTRACT

An approach is provided for collecting data files from target devices. A data collection manager implemented in a mobile device generates a collector based, at least in part, on collection definition data. The collector is configured to perform a data search on a target device. The data collection manager causes to transmit the collector to a network server for storing the collector in the network server, and causes to transmit a notification to the network server to notify a custodian of the target device that the collector is to be downloaded from the network server to the target device for execution. Executing the collector causes the collector to selectively determine one or more data files that have certain characteristics and that are hosted on the target device, collect the one or more data files from the target device, and store the one or more data files in the network server.

FIELD

Embodiments relate generally to an approach for collecting electronicdata and data files from target devices, and to reporting informationabout the collected data and files.

BACKGROUND

The approaches described in this section are approaches that could bepursued, but not necessarily approaches that have been previouslyconceived or pursued. Therefore, unless otherwise indicated, theapproaches described in this section may not be prior art to the claimsin this application and are not admitted to be prior art by inclusion inthis section.

Current approaches for collecting electronic data from target systemshave many limitations. One problem is that some conventional eDiscoverysystems collect all data residing on computer resources even if some ofthe data is neither used nor requested. Relying on such systems mayimpede achieving proportionality between the cost of the eDiscovery andthe amount of damages sought by claimants. For example, regardless ofwhether the amount of damages is in the range of thousands of dollars ormillions of dollars, the cost of legal discovery performed using theconventional systems may be the same.

Another problem is that some conventional eDiscovery systems areconfigured to generate only encrypted hard drive maps that are difficultto browse and review. Other systems may store the collected data only innon-cloud-based storage systems, which have limited accessibility andcapacity. In addition, many eDiscovery systems offer limited reportingfunctionality.

Moreover, since some systems may be configured to select electronic datafiles based only on extensions of the files, such selections may beinaccurate as users can easily modify the extensions. For example, if arequest is to select those image JPEG files that have the *.jpgextension, then the image files that are in the JPEG format, but havetheir extensions modified to extensions other than *.jpg, may beexcluded from the discovery.

Furthermore, some systems need to be implemented or installed onsite ofthe target system, and this may raise concerns about the integrity andsecurity of the collected data. Also, accessing and using some of thesystems may require specialized knowledge and experience, which may beunavailable in some situations. All the above may lead to anunsatisfactory user experience and concerns about security andefficiency of the data discovery process.

SUMMARY

One or more non-transitory computer-readable media storing instructionswhich, when processed by one or more processors, cause a data collectionmanager, implemented in a mobile device, generating a collector based,at least in part, on collection definition data. The collector isconfigured to perform a data search on a target device. The mobile datacollection manager also causes to transmit the collector to a networkserver for storing the collector in the network server. Furthermore, themobile data collection manager generates, and causes to be transmittedto the network server, a notification for notifying a custodian of thetarget device that the collector is to be downloaded from the networkserver to the target device for execution on the target device.Executing the collector on the target device causes the collector toselectively determine one or more data files that have certaincharacteristics and that are hosted on the target device, collect theone or more data files from the target device, and store the one or moredata files in the network server.

BRIEF DESCRIPTION OF THE DRAWINGS

In the figures of the accompanying drawings like reference numeralsrefer to similar elements.

FIG. 1 is a block diagram that depicts an example arrangement for a datacollection system architecture.

FIG. 2 is a block diagram that depicts an example arrangement for a datacollection system architecture.

FIG. 3 is a block diagram that depicts an example arrangement for a datacollection system architecture.

FIG. 4 is a block diagram that depicts examples of data collectionservices.

FIG. 5 is a block diagram that depicts examples of tasks performed by acustodian.

FIG. 6 is a block diagram that depicts examples of collector services.

FIG. 7 is a flow diagram that depicts an example approach for collectingdata and data files from a target system using a collector.

FIG. 8 is a massage ladder that depicts an example approach forcollecting data and data files from a target system using a collector.

FIG. 9 depicts a table that contains examples of signature data.

FIG. 10 is a snapshot of a file in the jpeg format that contains a filesignature.

FIG. 11 is a snapshot of a file in the pdf format that contains a filesignature.

FIG. 12 is a snapshot of a file in the xls format that contains a filesignature.

FIG. 13 is a flow diagram that depicts an example approach for dataanalysis and reporting.

FIG. 14 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying file categories.

FIG. 15 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying file categories.

FIG. 16 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying file extensions.

FIG. 17 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying computer drives to be searched.

FIG. 18 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying computer drives to be searched.

FIG. 19 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal for displayingfile signatures of files collected according to a specification providedby a user.

FIG. 20 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying chart types.

FIG. 21 depicts an example report generated by a data analysis andreporting tool that shows a summary report organized by signatures andrepresented as a bar chart.

FIG. 22 depicts an example report generated by a data analysis andreporting tool that that provides an administrator portal that forspecifying chart types.

FIG. 23 depicts an example report generated by a data analysis andreporting tool that shows a summary report organized by a file count percategory and represented as a pie chart.

FIG. 24 depicts an example report generated by a data analysis andreporting tool that shows a summary report organized by a file size percategory and represented as a pie chart.

FIG. 25 depicts an example report generated by a data analysis andreporting tool that shows a summary report organized by a signature.

FIG. 26 depicts an example report generated by a data analysis andreporting tool that shows a comma-separated-values (CSV) file.

FIG. 27 is a block diagram of a computer system on which embodiments maybe implemented.

DETAILED DESCRIPTION

In the following description, for the purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the present approach. It will be apparent, however, toone skilled in the art that embodiments may be practiced without thesespecific details. In other instances, well-known structures and devicesare shown in block diagram form in order to avoid unnecessarilyobscuring the embodiments. Various embodiments are described hereinafterin the following sections:

I. OVERVIEW II. DATA COLLECTION SYSTEM ARCHITECTURE

A. Requestor

B. Requestor Implemented in a Mobile Device

C. Data Collection Manager

D. Data Collection Manager Implemented in a Mobile Device

E. Target System

F. Collector

G. Network Storage Services

III. FILE SIGNATURES IV. EXAMPLE WORKFLOW FOR COLLECTING DATA AND DATAFILES V. EXPORTING COLLECTED DATA AND DATA FILES VI. DATA ANALYSIS ANDREPORTING TOOL

A. Functionalities of a Data Analysis and Reporting Tool

B. Example Workflow

VII. IMPLEMENTATION MECHANISMS I. OVERVIEW

An approach is provided for enhancing the process of collectingelectronic data and data files from target devices. The approach may beimplemented in electronic data discovery applications. The examplesincluded herein are provided merely for the purpose of explanation ofsome implementations of the approach, and are not to be viewed aslimiting the scope of the presented approach. For instance, the examplesincluded herein provided in the context of legal discovery or in thecontext of an audit process are not to be viewed as limiting theimplementations of the approach to merely the law-related applications.

In an embodiment, an approach for enhancing the process of collectingelectronic data and data files from target devices is implemented in acomputer-implemented data collection manager which generates a collectorconfigured to collect the data and files from the target devices. Thecollector may be configured to perform specialized searches of resourcesstored on the target computers of the involved parties. Settings for thespecialized search and the types of requested reports may be providedvia a graphical user interface of a dashboard implemented for example,as a data analysis and reporting tool.

In an embodiment, an approach for enhancing the process of eDiscoveryallows maintaining proportionality between the cost of the discovery andthe amount of the sought damages. By taking into consideration theamount of damages in determining the scope of the discovery, the cost ofthe discovery may be tailored to the amount that is reasonable to theinvolved parties. This allows avoiding situations where the cost of thelegal discovery is disproportionally high to the amount of damages. Theapproach allows customizing the scope and cost of the search. Forexample, if the requested damages are relatively high, then the scope ofthe discovery may be relatively broad and comprehensive. However, if therequested damages are relatively low, then the scope of the discoverymay be relatively narrow and specialized.

In an embodiment, the proportionality between the cost of the discoveryand the amount of the damages sought is maintained by implementingcustomization capabilities to the data collection process. Customizationallows specifying the types of data and data files that the involvedparties require. This allows avoiding situations in which more data andfiles is collected from the target systems than is needed, and in whichthe cost of collecting such data and files from the target systemsbecomes unreasonably high in light of the sought damages.

In an embodiment, an approach for enhancing the process of electronicdata discovery allows engaging an independent data collection service toperform data collection in a secure and independent manner. For example,a data collection manager may be used to generate and deploy acomputer-implemented-collector configured to collect data from a targetsystem in the way that allows preserving the integrity and authenticityof the collected data, which may be critical in many aspects and for allinvolved parties.

In an embodiment, an approach for enhancing the process of datadiscovery is configured to utilize any type of storage media, includingcloud resources. For example, once a data collection service receivesfrom a requestor a request to collect data from a target system andgenerates a collector configured to collect the requested data and datafiles, the collector may be stored in a cloud network and downloadedfrom the cloud network to the target system. Once the requested data anddata files are collected, they can be stored in the cloud network or anyother network of servers.

In an embodiment, an approach for enhancing an electronic data discoveryprocess allows identifying the data files to be collected based onunique signatures of the files. A unique signature may represent uniquecharacteristics of the file, and may be embedded in the file. Usingunique signatures of the files to identify the data files to becollected is more desirable than using file extensions included in thefile names because the file extensions may not necessarily correspond tothe actual type of the file. Since the file extensions, not the filesignatures, can be modified by the user, collection based on the filesignatures provides more accurate collection results than if thecollection is performed based on the file extensions.

In an embodiment, an approach for enhancing an electronic data discoveryprocess allows generating various types of reports for presentinginformation about the collected data and data files. Various filters maybe applied to manage the amount of reporting data and to manage theamount of contents presented in the reports. The reports may becustomized to provide relevant data selected from the collected datafiles.

In an embodiment, an approach for enhancing a discovery process providesa user interface for determining types of data files to be collected,target resources from which the data files are to be collected, storageson which the collected data files are to be stored, and types of reportsto be prepared based on the collected data files. The interface may beimplemented in a data analysis and reporting tool provided to theinvolved parties and users.

II. DATA COLLECTION SYSTEM ARCHITECTURE

FIGS. 1-3 are block diagrams that depict an example arrangement 100 fora data collection system architecture. Embodiments are not limited tothe example arrangement 100 depicted in FIGS. 1-3, and other examplearrangements are described hereinafter. In the examples depicted inFIGS. 1-3, arrangement 100 includes a requestor system 110, a targetsystem 120, a data collection service 130, and one or more networkstorage services 140. Requestor system 110 is also referred to herein asrequestor 110.

Example arrangement 100 may be implemented in computer systemsconfigured to perform any type of electronic data discovery. Theexamples included herein are provided merely for the purpose ofexplanation of some implementations of example arrangement 100, and arenot to be viewed as limiting the implementation scope of arrangement100.

Example arrangement 100 may include various types of communicationslinks used to facilitate communications between requestor 110, targetsystem 120, data collection service 130 and network storage services140.

In an embodiment, requestor 110, target system 120, data collectionservice 130 and network storage services 140 are communicatively coupledwith each other via communications links. Communications links may beestablished across any number of communications networks such as, forexample, one or more Local Area Networks (LANs), Wide Area Networks(WANs), Ethernet networks or the Internet, and/or one or moreterrestrial, satellite or wireless links. The types and configurationsof network and communications links may vary depending upon a particularimplementation.

A. Requestor

Requestor system (or requestor) 110 depicted in FIGS. 1-3 is acomputer-based-system used by a user who requests collecting electronicdata and data files from target system 120. Requestor 110 may use datacollection service 130 to define and deploy a collector 144, which isconfigured to perform the electronic data discovery on target system120.

Requestor 110 may be any type of client device, depending upon theparticular implementation. Example client devices include, withoutlimitation, personal or laptop computers, workstations, tabletcomputers, personal digital assistants (PDAs) and telephony devices suchas smart phones. The client device may include applications including,for example, a Web browser and other client-side applications. A clientdevice may include other elements, such as a user interface, one or moreprocessors and memory, including volatile memory and non-volatilememory.

For example, requestor system 110 may be a computer system accessible toone or more users who are, or who represent, a claimant party. Aclaimant may be a plaintiff, a petitioner, a supplicant or any otherparty requesting any type of discovery of electronic data and data filesresiding on target system 120. In one implementation, a user ofrequestor system 110 may be a plaintiff bringing a suit against adefendant and requesting a legal discovery of electronic data stored ontarget system 120 owned by the defendant. In another implementation, auser of requestor system 110 may be a governmental agency performing anaudit of electronic data and data files stored on target system 120owned by an audited company.

Requestor system 110 may be implemented by hardware, computer software,or any combination of hardware and computer software. One non-limitingexample implementation of requestor system 110 is a computer systemhosting various applications and any type of electronic document data inany form, including structured data and unstructured data.

One or more users may access requestor system 110 and may specify thetype of data and files to be collected from target system 120.Specifications provided by the users of requestor system 110 are alsoreferred to as collection definition data. The users may communicate thespecification of the type of data to be collected from target system 120to data collection service 130 by sending (82) a request to datacollection service 130. Data collection service 130 may process therequest, generate a collector 144 configured to collect the specifieddata and data files from target system 120, store the collected data andfiles in network storage services 140, and inform data collectionservice 130 (and/or requestor 110) that the collected data has beenstored. The collected data and files may be stored on network storageservices 140 implemented in a cloud service or any other storageaccessible to data collection service 130 and users of requestor 110.

Once the requested data and data files are collected from target system120, users of requestor system 110 may receive (94) a confirmation fromdata collection service 130. Although depicted in the figures anddescribed herein in the context of an email for purposes of explanation,the confirmation from data collection service 130 may be in any formthat may vary depending upon a particular implementation. According toan alternative embodiment (not depicted in FIGS. 1-3), users ofrequestor system 110 may receive a confirmation from network storageservices 140 or from collector 144. Upon receiving a confirmation fromany source, users of requestor system 110 may launch an application thatis configured to access the collected data and data files. Theapplication may allow the users to view contents of the collected files,generate various types of reports created based on the contents of thecollected files, view the reports and collected data filtered usingvarious filters, and the like.

In an embodiment, a user of requestor 110 may be able to request andreceive a report generated based on data and files that have beencollected from target system 120. For example, a user may be able toaccess a data analysis and reporting tool, and request a customizedreport for viewing the collected data and files. Examples of the dataanalysis and report tool and examples of reports that can be generatedby the tool are described in FIGS. 13-26.

B. Requestor Implemented in a Mobile Device

In an embodiment, requestor system 110 is a computer-based-systemimplemented in a mobile device. For example, requestor system 110 may beimplemented in a mobile device such as a smart phone, a tablet, aportable computer, and the like. A user of the mobile device may invokean application residing on the mobile device and use the application torequests collecting electronic data and data files from target system120. A user of the mobile device implementing requestor 110 may use datacollection service 130 to define and deploy a collector 144, which isconfigured to perform the electronic data discovery on target system120, as described above.

C. Data Collection Service

Data collection service 130 is a computer-based-system used to receiverequests for collecting data from target system 120 and to generate acollector configured to collect the requested data from target system120. Data collection service 130 may be any type of client device.Example client devices include, without limitation, personal or laptopcomputers, workstations, tablet computers, personal digital assistants(PDAs), telephony devices such as smart phones, and the like. The clientdevice may include applications including, for example, a Web browserand other client-side applications. The client device may include otherelements, such as a user interface, one or more processors and memory,including volatile memory and non-volatile memory.

FIG. 4 is a block diagram that depicts examples of data collectionservices. The depicted examples are to be viewed as non-limited examplesof the services that may be provided by data collection service 130. Forexample, data collection service 130 may be configured to specify 402file types to be searched, specify 404 sources to be searched, specify406 whether, or which, attachments are to be searched, and specify 408whether legal forms, such as court orders and other legal documents, areto be included in legal discovery.

Furthermore, data collection service 130 may be configured to specify410 storage types that are to be searched, and specify 412 storagelocations that are to be searched or used to store collected data anddata files.

Data collection service 130 may also be configured to retrieve andprovide user credentials 414, group credentials 416 and otherauthentication information to be used by a collector to perform legaldiscovery.

Data collection service 130 may also be configured to specify 418 timeconstrains for performing legal discovery, specify 420 types ofprocessing, specify 422 types of modifications (if any), specify 424methods of communicating results of legal discovery, specify 426 emailaddresses to be used by a collector and/or a custodian, specify 428types of notifications, specify 430 error handling procedures, and thelike.

Moreover, data collection service 130 may be configured to specify 432 ahyperlink to a cloud data storage using which a collector may bedownloaded onto target system 120, and specify 434 an executionenvironment for executing a collector. Other functionalities andcapabilities may also be implemented in data collection service 130.

In an embodiment, data collection service 130 is configured to receive arequest from a user of requestor 110. The request may provideinstructions specifying the types of data and data files to be collectedand instructions specifying the computer resources of target system 120from which the data and files are to be collected.

Upon receiving the request, data collection service 130 may generatecollector 144, and cause to transmit (86) collector 144 to networkstorage services 140 to cause storing collector 144 on a server managedby network storage services 140.

Data collection service 130 may also generate a notification 134indicating that collector 144 has been deployed and stored in networkstorage services 140, and send (84) notification 134 to target system120. Notification 134 may be implemented as any type of electronicmessage or communication. For example, notification 134 may be anelectronic email that data collection service 130 generates and sends toa user of target system 120 to notify the user of target system 120 thattarget system is for example, in a litigation hold, and a court orderhas been issued to collect data and data files form target system 120.Notification 134 may include a copy of the court order, or a link to thecopy of the court order.

Furthermore, notification 134 may include instructions for a user oftarget system 120 for accessing and downloading (88) collector 144 fromnetwork storage services 140 onto target system 120 to cause executionof collector 144 on target system 120. Furthermore, notification 134 mayinclude an identification of the location at which collector 144 hasbeen stored in network storage services 140. For example, notification134 may include instructions stating “please select the hyperlinkprovided below to start a data collection process of the data and datafiles stored on your computer devices.” Once a user of target system 120selects the particular hyperlink, collector 144 may be downloaded (88)onto target system 120, and execution of collector 144 on target system120 can start.

Execution of collector 144 on target system 120 may result in collectingdata and data files from target system 120 specified by data collectionservice 130, and storing the collected data and data files at somelocation on network storage services 140.

Once collection of data and data files from target system 120 iscompleted, data collection service 130 may receive an electroniccommunication 164 from either target system 120 (as depicted in FIGS.1-3) or from other sources (not depicted in FIGS. 1-3). Sending email164 is optional. Email 164 may include an indication that the dataand/or data files have been collected and stored in network storageservices 140, such as a cloud service, a server managed by a serviceprovider, and the like

In an embodiment, a user of data collection service 130 may request andreceive a report of data and files that have been collected from targetsystem 120. For example, a user may access a data analysis and reportingtool, and request a customized report for viewing the collected data andfiles. An example of the data analysis and report tool and examples ofreports that can be generated by the tool are described in FIGS. 13-26.

D. Data Collection Service Implemented in a Mobile Device

In an embodiment, data collection service 130 is a computer-based-systemimplemented in a mobile device. For example, data collection service 130may be implemented in a mobile device such as a smart phone, a tablet, aportable computer, and the like. A user of the mobile device may invokean application residing on the mobile device and use the application toreceive requests for collecting electronic data and data files fromtarget system 120. A user of the mobile device implementing datacollection service 130 may use data collection service 130 to define anddeploy collector 144 configured to perform the electronic data discoveryon target system 120, send notifications to users of target system 120and to users of requestor 110, and receive communications from targetsystem 120, as described above.

E. Target System

Target system 120 is a computer-based-system that hosts data and datafiles that are to be collected. Target system 120 may include one ormore computing devices and may be configured as a standalone system or amulti-unit computer system. For example, target system 120 may includeonly just one device, such as a workstation or a laptop. Alternatively,target system 120 may include a plurality of computer devicecommunicatively coupled with each other via wireless or wiredcommunications links.

Target system 120 may include one or more devices of any type. Exampleclient devices include, without limitation, personal or laptopcomputers, workstations, tablet computers, personal digital assistants(PDAs) and telephony devices such as smart phones. The client devicesmay include applications including, for example, Web browsers and otherclient-side applications. The client devices may include other elements,such as a user interface, one or more processors and memory, includingvolatile memory and non-volatile memory.

FIG. 2 is block diagrams that depict an example arrangement 100 for datacollection system architecture. In addition to the elements describedabove and depicted in FIG. 1, FIG. 2 depicts examples of user devicesthat may be included in target system 120. The example devices depictedin FIG. 2 are to be viewed as non-limiting examples of the devices, andhave been provided to illustrate some of many user devices that may beused in the data collection approach.

Target system 120 depicted in FIG. 2 comprises a plurality of userdevices, including one or more smart phones 210, one or more tablets212, one or more computer workstations 214 and one or morecomputer-implemented-servers 216. Other implementations of target system120 may include some of the user devices listed above, or include otherdevices not listed above.

In an embodiment, target system 120 includes one or more storage devicesused to store one or more databases 218. For example, target system 120may include several storage devices that communicate with each other andare used to host one or more databases 218 containing data and datafiles to be collected by collector 144.

Once data collection service 130 creates and deploys collector 144, datacollection service 130 may send (84) a notification 134 to a user oftarget system 120 to notify the user that a data collection request hasbeen issued against data owned or managed by the user, and acomputer-implemented collector 144 is ready to be downloaded to targetsystem 120 to collect the requested data from target system 120.

A user of target system 120 may be any entity whose electronic data isto be collected, audited, or otherwise requested. For example, a user oftarget system 120 may be a user of a smart phone 210, on which data tobe collected is stored. According to another example, a user of targetsystem 120 may be a user of tablet 212 and one or more servers 216, onwhich data to be collected is stored. According to other example, a userof target system 120 may be a custodian of one or more devices 210-218that are hosted by target system 120 and that contain data and datafiles to be collected by collector 144.

A custodian is the context of the approach for collecting data and datafiles from target system 120 is a person (or persons) who is responsiblefor managing and maintaining one or more computer resources in targetsystem 120. For example, a custodian of target system 120 may be anowner of a computer device of target system 120. According to anotherexample, a custodian of target system 120 may be a system administratorof the computer devices included in target system 120. According toother example, a custodian of target system 120 may be a serviceprovider that manages computer resources of target system 120. The termcustodian and the term user of target system 120 are usedinterchangeably herein.

FIG. 5 is a block diagram that depicts examples of tasks performed by acustodian. The example tasks depicted in FIG. 5 are to be viewed asnon-limiting examples of a variety of tasks to be performed by acustodian.

In the example depicted in FIG. 5, a custodian may be responsible formanaging 502 notifications exchanged with target system 120. Thenotifications may include the notifications that are received by targetsystem 120 as well as the notifications that are sent from target system120. For example, a custodian may be a contact person to whomnotifications about legal discovery are sent. Notifications may includerequests for downloading a collector onto computer systems of targetsystem 120, requests for providing credentials for access to thecomputer systems of target system 120, and the like.

A custodian may also be responsible for downloading 504 a collector ontocomputer resources of target system 120. For example, upon receiving anotification about a legal discovery request, a custodian may be askedto select an indicated hyperlink to facilitate downloading a collectoronto computer resources of target system 120. Other method ofdownloading a collector may also be implemented.

Once a user (or a custodian) of target system 120 receives notification134 indicating that collector 144 is ready to be downloaded onto targetsystem 120, the user may initiate the downloading. To accomplish that, auser may for example, select a hyperlink provided in notification 134.By selecting the hyperlink, the user may initiate downloading (88) ofcollector 144 from network storage services 140 to one or more devicesof target storage services 140.

Depending on the implementation of collector 144, downloading ofcollector 144 may include creating an instance of collector 144 andinstalling the instance on target system 120. Alternatively, thedownloading may include making a copy of collector 144 and transmittingthe copy to target system 120.

A custodian may also be responsible for initiating 506 execution of acollector on computer resources of target system 120. For example, acustodian may be provided with instructions for starting a collectoronce the collector is downloaded onto target system 120.

Once collector 144 is downloaded onto target system 120, collector 144starts collecting data and data files specified by data collectionservice and requested by requestor 110.

Access to resources of target system 120 may be facilitated by a user ora custodian of target system 120. For example, a user of target system120 may be asked to provide access credentials for accessing the user'sdata stored on devices of target system 120. The user may also be askedto provide credentials of a system administrator for accessing systemdata stored on devices of target system 120.

Collection of data and data files from target system 120 may includecollecting various types of data and files, including data files havingspecific types and hosted by specific devices or residing in specificdirectories. For example, the collection may include collecting data anddata files that are JPG image files hosted by workstation 214.

In an embodiment, identifying data and data files that have specifictypes is performed based on unique signatures that are embedded in thedata files. Using unique signatures of the files to identify the datafiles to be collected is more reliable than using file extensionsincluded in the file names because the file extensions may notnecessarily correspond to the actual type of the file. Relying on thefile signatures enables providing more accurate collection results thanif the data collection is performed based on the file extensions.

According to another example, a collection may include collecting alldata and files, including hidden files and system administration filesthat are stored in database 218.

Once collection of all requested data and data files from computerresources of target system 120 is completed, the collected data andfiles 154 may be transmitted (90) to network storage services 140.Optionally, an electronic email 164 may be sent to data collectionservice 130 to indicate that the collection has been completed.

In an embodiment, a user of target system 120 requests and receivesreports and summaries generated based on data and files that have beencollected from target system 120. For example, a user may be able toaccess a data analysis and reporting tool, and request a customizedreport for viewing the collected data and files. Examples of the dataanalysis and report tools and examples of reports that can be generatedby the tool are described in FIGS. 13-26.

In an embodiment, a process of collecting data and data files fromtarget system 120 allows preserving the integrity and security of thecollected data. Since the data and files are collected from targetsystem 120 independently from users and owners of target system 120, themanner in which the data and files are collected assures a high level ofreliability of the data.

F. Collector

In an embodiment, collector 144 is a software application configured tocollect electronic data and data files from target system 120. In thecontext of deployment of collector 144, collector 144 is viewed as aninstance or an executable code that can be downloaded, installed andexecuted on computer resources of target system 120.

Collector 144 may be created and deployed by data collection service130, as depicted in FIGS. 1-3. Alternatively, collector 144 may becreated and deployed by a user of requestor 110, or any other entityrequesting a collection of the data and files from target system 120.

FIG. 3 is a block diagram that depicts an example arrangement 100 fordata collection system architecture. In addition to the elementsdescribed above and depicted in FIGS. 1-2, FIG. 3 depicts examplecomponents that may be included in collector 144. The example componentsof collector 144 depicted in FIG. 3 are to be viewed as non-limitingexamples of the components, and have been provided to illustrate some ofmany types of components that may be implemented in collector 144.

In the example depicted in FIG. 3, collector 144 comprises a collectionmanager 310, a communications manager 320, and a collectionspecification data 330. Other implementations of collector 144 mayinclude additional components or components not shown in FIG. 3.

Collection specification data 330 includes data that describes types ofdata and data files to be collected and data that describes resources oftarget system 120 from which the data and data files are to becollected. For example, collection specification data 330 may specifythat collected information is to include all image files in the JPGformat that are hosted by standalone workstations of target system 120.

Identifying the image files that are in the JPG format may be performedusing various approaches, including the approach based on usingsignatures embedded in the files. Using file signatures appears to bemore reliable than using file extensions because the file extensions,not file signatures, may be modified by users.

According to another example, collection specification data 330 mayspecify that collected information is to include all PDF files createdafter a particular date and hosted by each and every device included intarget system 120. The examples provided herein are not to be viewed aslimiting the scope of data that may be stored as collectionspecification data 330.

In an embodiment, collection specification data 330 is generated basedon collection definition data provided by users of requestor 110, usersof data collection service 130, and the like.

Collection manager 310 is configured to perform a collection of data anddata files, specified by collection specification data 330, fromresources of target system 120. Collection manager 310 may beimplemented as an executable module configured to execute instructionsfor collecting the specified data and data files from the specifieddevices and locations on target system 120.

Communications manager 320 is configured to facilitate access to dataand data files from resources of target system 120 specified bycollection specification data 330. For example, if collectionspecification data 330 indicates that the collection is to include allsystem files residing on all servers hosted by target system 120, thencommunications manager 320 may facilitate access to the system files onall servers of target system 120.

In an embodiment, collector 144 is created by data collection service130 in response to data collection service 130 receiving a request froma user of requestor 110. The request may provide instructions specifyingthe types of data and data files to be collected and specifying thecomputer resources of target system 120 from which the data and filesare to be collected. As data collection service 130 generates collector144, data collection service 130 may also store the specification of thedata types and the computer resources to be searched in collectionspecification data 330 of collector 144. Specification of the data typesto be searched and the data computer resources to be searched may bebased on the collection definition data described above.

Once collector 144 is created and transmitted (86) to network storageservices 140, collector 144 is stored in network storage services 140.Data collection service 130 may also notify a user of target system 120that collector 144 has been deployed and is ready to be downloaded totarget system 120.

In an embodiment, collector 144 may be downloaded (88) when a user oftarget selects a link, such as a hyperlink, provided to the user innotification 134. Once the download is completed, execution of collector144 may start.

FIG. 6 is a block diagram that depicts examples of collector services.The depicted examples of services provided by collector 144 are to beviewed as non-limited examples of various services. For example,collector 144 may be configured to collect 602 data and data files fromcomputer resources of target system 120, determine 604 data formats andmedia for sending the collected data and data files, and transmit 606the collected data and data files in logical containers compatible withthe determined data formats.

Collector 144 may also be configured to send 608 notifications to users.Notification may include notifications to a custodian of target system120, notifications to a user of data collection service 130, and/ornotifications to a user of requestor system 110.

In an embodiment, as collector 144 is executed on target system 120,collector 144 collects from target system 120 data and data files thatare specified by collection specification data 330, and stores thecollected data and data files at network storage services 140. Theprocess of collecting data and data files from target system 120 allowspreserving the integrity and security of the collected data because thedata and files are collected from target system 120 independently fromusers and owners of target system 120.

Storing of the collected data and data files may involve determining aformat that is the best suited for transmitting and storing thecollected data and data files in network storage services 140. Selectinga format that is suitable may be viewed as determining a “container” inwhich the collected data and data files may be exported for storing. Forexample, a container may be data files represented in a data format thatis known to user devices of requestor 110 and data collection service130.

A container may be selected based on a variety factors, including,without limitation, the size to the collected data and data files,available bandwidth of network connections between target system 120 andnetwork storage services 140

Once collection of data and data files from target system 120 iscompleted, collector 144 (or target system 120) may generate anelectronic communication 164 and cause sending (94) electroniccommunication 164 to data collection service. Sending email 164 isoptional. Email 164 may include an indication that the data and/or datafiles have been collected and stored in network storage services 140,such as a cloud service, a server managed by a service provider, and thelike. Although depicted in the figures and described herein in thecontext of an email for purposes of explanation, the electroniccommunication 164 from collector 144 may be in any form that may varydepending upon a particular implementation.

In an embodiment, a user of network storage services 140 and/or users ofdata collection service 130 may be able to request and receive a reportof data and files that have been collected from target system 120. Forexample, a user may be able to access a data analysis and reportingtool, and request a customized report for viewing the collected data andfiles. An example of the data analysis and report tool and examples ofreports that can be generated by the tool are described in FIGS. 13-26.

G. Network Storage Services

In an embodiment, network storage services 140 is a computer-basedsystem configured to store electronic data. Network storage services 140may be implemented in one or more computing devices configured to storedata and data files on one or more servers. For example, network storageservices 140 may be implemented in devices such as magnetic disks,optical disks, and the like.

Network storage services 140 may be implemented in any type of serverand may be managed by any type of entity. For example, network storageservices 140 may be a cloud service.

Network storage services 140 may be configured to store informationreceived from requestor 110, data collection service 130 and targetsystem 120, and to make the stored information available to any of theabove elements.

III. FILE SIGNATURES

In an embodiment, data and data files are identified as being stored ina particular format based on a file signature embedded in the data file,rather than merely based on a file extension associated with the datafile name.

A file format is a standard way that information is encoded for storagein a computer file. It specifies how bits of the data are used to encodeinformation in a digital storage medium. File formats may be eitherproprietary or free, and may be either unpublished or open.

One popular method used by many operating systems is to determine theformat of a data file based on the file name extension. A file nameextension is usually included in the file name and represented by theletters following the final period in the name. For example, HTMLdocuments are identified by names that end with *.html (or *.htm), andGIF images by *.gif.

One problem with using file extensions for identifying the formal ofdata files is that relying on the extensions may not be dependable. Auser may rename a data file by manually changing the extension of thefile. For example, a data file that was named for example asfilename.html may be renamed to filename.txt, and thus becomeunrecognizable as an HTML file.

In an embodiment, data files are recognized based on information thatspecifies the file type format and that is stored inside the fileitself, and not merely based on a file extension included in the name ofthe data file. Such information may include data, such as binary stringsor other information, embedded in the content of the data files. Thedata specifying the file type format are usually embedded in specificlocations in files. The data are also referred to as the data fileformat metadata or a signature of the data file. The data may berepresented in ASCII format, hexadecimal format, or any other format.

FIG. 9 depicts a table that contains examples of signature data. Thedepicted examples are to be viewed as non-limiting examples ofsignatures of data files. Column 910 of the table lists different typesof data file formats. Column 920 of the table provides hexadecimalrepresentations of the signatures for the data file formats listed incolumn 910. Column 930 of the table provides the ISO 8859-1representations of the signatures for the data file formats listed incolumn 910. Non-limiting examples of some of the signatures embedded inactual data files are depicted in FIGS. 10-12.

FIG. 10 is a snapshot of a file 1020 in the JPG format that contains afile signature 1010. As depicted in FIG. 10, signature 1010 isrepresented in file 1020 in ISO 8859-1 format as “ÿØÿà,” and appears atthe beginning of the data file. Other representations of signature 1010may also be implemented.

FIG. 11 is a snapshot of a file 1120 in the PDF format that contains afile signature 1110. As depicted in FIG. 11, signature 1110 isrepresented in file 1120 in ISO 8859-1 format as “% PDF,” and appears atthe beginning of the data file. Other representations of signature 1110may also be implemented.

FIG. 12 is a snapshot of a file 1220 in the XLS format that contains afile signature 1210. As depicted in FIG. 12, signature 1210 isrepresented in file 1220 in ISO 8859-1 format as “PK..,” and appears atthe beginning of the data file. Other representations of signature 1210may also be implemented.

Using file signatures embedded in data files to identify data files forthe purpose of performing legal discovery is preferable because itallows recognizing the data files that are in a particular format, evenif some of the files have extensions other than those indicating theparticular format. The approach for legal discovery allows searching andidentifying the data files that are in the particular format based ondata, such as signatures, embedded in the data files themselves, notmerely based on file extensions that may be easily modified.

IV. EXAMPLE WORKFLOW FOR COLLECTING DATA AND DATA FILES

In an embodiment, a process of requesting, collecting and storing dataand data files for the purpose of legal discovery is performed by one ormore entities that communicate with each other and exchange informationamong each other. A request for performing the legal discovery on targetsystem 120 may be created by a user of requestor 110 and communicated todata collection service 130. Based on the received data, data collectionservice 130 may generate a collector, and deploy the collector to targetsystem 120. The collector may collect the requested data and data files,and cause transmitting the collected data and data files to networkstorage services 140. Examples of workflows for requesting, collectingand storing data and data files for the purpose of legal discovery aredepicted in FIGS. 7-8.

FIG. 8 is a massage ladder that depicts an example approach forcollecting data and data files from a target system 120 using acollector. According to the depicted example, a user of requestor 110generates a request to collect and storing certain data and data filesfor the purpose of legal discovery. The user may specify the type ofdata and data files to be collected, the time periods for which the dataand data files are to be collected, computer resources of target system120 from which the data and data files are to be collected, and thelike. The user-provided specification is also referred to as collectiondefinition data. The collection definition data may be stored in networkstorage services 140, or included in a request generated by requestor110.

In an embodiment, data files types may be specified by providing digitalsignatures of the data files. Examples of various signatures aredescribed in FIGS. 9-12.

In step 802 of FIG. 8, a user of requestor 110 sends a request to datacollection service 130. The request may include collection definitiondata containing the details of the request. Alternatively, the requestmay include one or more hyperlinks pointing to locations at networkstorage services 140 on which the collection definition data has beenstored.

Upon receiving a request from requestor 110, data collection service 130may analyze the request, and use the information included in the requestto generate a collector. Various tasks involved in generating acollector are described FIG. 7.

FIG. 7 is a flow diagram that depicts an example approach for collectingdata and data files from a target system 120 using a collector. In step702, data collection service 130 generates a collector. Usinginformation included in a request received from requestor 110, datacollection service 130 may generate collection definition data.

Collection definition data may include information about file types ofdata files to be searched, sources to be searched, indications ofwhether, or which, attachments are to be searched, and indicationswhether legal forms, such as court orders and other legal documents, areto be included in legal discovery. Collection definition data may alsoinclude information about storage types that are to be searched, andstorage locations that are to be searched. Furthermore, collectiondefinition data may include user credentials, group credentials 416 andother authentication information to be used by a collector to performlegal discovery. In some implementations, some or all of the aboveinformation may be already stored in the collection definition data. Forexample, some of the information may be already provided and stored by auser of requestor 110.

Collection definition data may further include time constrains forperforming legal discovery, types of processing, types of modifications(if any), methods of communicating results of legal discovery, emailaddresses to be used by a collector and/or a custodian, types ofnotifications, error handling procedures, and the like. Collectiondefinition data may also include a hyperlink to a cloud data storagefrom which a collector may be downloaded onto target system 120. Othertypes of information not described above may also be included in thecollection definition data.

In step 704, data collection service 130 causes transmitting a collectorto network storage services 140. Transmitting a collector to networkstorage services 140 is also depicted in FIG. 8, in which, in step 804,a collector is deployed to network storage services 140.

Referring again to FIG. 7, in step 706, data collection service 130generates a notification and causes transmitting the notification to acustodian of target system 120. This is also depicted in FIG. 8, inwhich, in step 806, data collection service 130 notifies a custodian oftarget system 120.

A notification to a custodian may be transmitted as an electronic mailto notify a user of target system 120 that target system is for example,in a litigation hold. The electronic mail may also indicate that a courtorder has been issued to collect data and data files form target system120. For example, the email may include a copy of the court order.

In an embodiment, an electronic mail sent to a custodian of a targetsystem 120 includes instructions for accessing and downloading acollector from network storage services 140 onto target system 120 tostart execution of the collector on target system 120. Furthermore, theemail may include an identification of the location at which thecollector has been stored in network storage services 140, and othertypes of information.

In step 708, target system 120 receives a notification, such as anelectronic mail, from data collection service 130. This is also depictedin FIG. 8, in which, in step 808, target system 120 receives anotification from data collection service 130.

Alternatively, target system 120 may receive a notification about thelegal discovery directly from requestor 110. For example, a user ofrequestor 110 may contact a custodian of target system 120 directly bysending an electronic message to the custodian and providing informationabout accessing, downloading and executing a collector. This embodimentis not depicted in FIGS. 7-8.

In step 809 of FIG. 8, upon receiving a notification, a custodian (or auser) of target system 120 may review the notification and proceed toaccepting the instructions for downloading a collector onto one or morecomputer resources of target system 120. For example, a notification mayinclude a hyperlink and instructions indicating that upon selecting thehyperlink, a collector will be downloaded onto target system 120.

In step 810 of FIG. 8 (also in step 710 of FIG. 7), a custodian oftarget system 120 causes downloading a collector from network storageservices 140 onto computer resources of target system 120. Variousmethods of downloading a collector onto target system 120 are describedabove.

In step 812, a collector collects data and data files from computerresources of target system 120. The data and data files to be collectedand the specification of the resources to be searched may be specifiedin collection definition data that is accessible to the collector fromnetwork storage services 140, or from other storage devices. Varioustasks performed by a collector are described in FIG. 6.

Once collection of the requested data and data files has been completed,a collector may store the collected data and data files in networkstorage services 140. For example the collected data and data files maybe stored in a cloud service managed by network storage services 140, ormay be stored in any storage device managed by network storage services140. Alternatively, the collected data and data files may be transmittedto requestor 110, and/or data collection service 130.

Upon completing a data collection from computer resources of targetsystem 120, a collector may generate notifications to the interestedparties. For example, a collector may generate a notification to acustodian of target system 120, to notify the custodian that thecollection of the requested data and data files has been completed andthat the requested data and data files have been stored in networkstorage services 140.

In step 712 of FIG. 7, a custodian of target system 120 receives anotification indicating that a collection of the requested data and datafiles has been completed and that the requested data and data files havebeen stored in network storage services 140. Upon receiving such anotification, the custodian of target system 120 may generate and sendto data collection service 130 a notification that indicates acompletion of the collection to data collection service 130.Alternatively, the custodian may forward the received notification todata collection service 130.

Additionally, or alternatively, a collector may generate a notificationto a user of requestor 110 to inform the user that the collection of therequested data and data files has been completed. A collector may alsogenerate a notification to data collection service 130 to indicate thatthe collection of the requested data and data files has been completed.

In step 714 of FIG. 7, data collection service 130 receives anotification from a collector indicating that requested data and datafiles have been stored in network storage services 140. Data collectionservice 130 also determines whether the collection was successful. Forexample, data collection service 130 may access the stored data and datafiles and verify whether the stored information indeed includes therequested data and data files. Furthermore, data collection service 130may verify whether any error massages have been included or receivedfrom a collector.

If a collection of the requested data and data files was successful,then in step 716 of FIG. 7 (and in step 824 of FIG. 8), data collectionservice 130 notifies requestor 110 that a collection of the requesteddata and data files was successful and that the requested data and datafiles have been successful stored in network storage services 140. Thenotification may also include an indication of the location of thestored data and data files and instructions for accessing the storedinformation.

However, if a collection of the requested data and data files was notcompletely successful, then, in step 718, data collection service 130may attempt to determine solutions for the problems. For example, datacollection service 130 may review the manner in which a collector wasgenerated and deployed, and if possible, modify the collector. Accordingto another example, data collection service 130 may send messages to acustodian of target system 120 to request additional information aboutthe collection process and to request error logs generated by acollector. Furthermore, data collection service 130 may reviewcollection definition data, and if possible modify the collectiondefinition data and redeploy a collector.

The process of requesting, collection and storing data and data filesfrom target system 120 ends in step 720. The process may be repeatedeach time a request for legal discovery is issued or modified byrequestor 110. Furthermore, the process may be repeated each time acollector is modified and redeployed. Moreover, the process may berepeated each time collection definition data is modified and providedto a collector.

V. EXPORTING COLLECTED DATA AND DATA FILES

In an embodiment, collected data and data files may be exported tonetwork storage services 140 in a variety of formats. Non-limitingexamples of the formats in which the collected data and data files maybe exported is the comma-separated values (CSV) format.

The comma-separated values (CSV) format is a widely used text fileformat for exchanging data between computer devices and applications.The CSV format may be implemented in a variety of ways, but usually itspecifies that data records are to be concatenated and each field of thedata records be delimited using a comma. CSV allows exporting tabulardata between programs that natively operate on incompatible formats. CSVis widely supported by a variety of computer systems and devices.

In an embodiment, a collector collects the requested data and data filesand exports the collected data and data files in the CSV format.Exporting the collected data and data files in the CSV format mayinclude creating a data file in the CSV format. The CSV data file needsto be large enough to accommodate data of the collected data and datafiles. The CSV data file may contain data records in which the collecteddata and data files are stored in such a way that the individual recordsof the CSV file are separate using commas.

In an embodiment, a CSV file is transmitted to network storage services140. Upon receiving the CSV data file, network storage services 140parses the CSV file, and stores the data records of the CSV file in datastructures that are native to network storage services 140 and that areaccessible to users of requestor 110.

Other method of exporting the collected data and datawork storageservices 140 may also be implemented.

VI. DATA ANALYSIS AND REPORTING TOOL

Data analysis and reporting tool is a computer implemented applicationconfigured to facilitate generating requests for data collection fromtarget system 120, performing the collection, and reviewing thecollected data and data files. Data analysis and report tool may beimplemented as a software application hosted by a standalone system, oras a software application facilitating access to shared and distributedresources hosted by a plurality of computer systems.

A. Functionalities of a Data Analysis and Reporting Tool

In an embodiment, a data analysis and reporting tool is available to oneor more entities involved in requesting, collecting and providing dataand data files from target system 120. In some implementations, the samedata analysis and reporting tool may be used by users of requestorsystem 110, users of data collection service 130, users of target system120, or optionally by users of network storage services 140. If some ofthe capabilities of the data analysis and reporting tool are restrictedto some users, then the tool may be designed to customize thecapabilities of the tool based on credentials or authorization of thespecific users. In some other implementations, a data analysis andreporting tool is customized to specific needs of the users, anddifferent versions of the tool or even different tools may be deployedfor users of requestor system 110, users of data collection service 130,users of target system 120, and users of network storage services 140.

In an embodiment, a data analysis and reporting tool may be used by auser of requestor system 110 to specify a request for collecting dataand data files from target system 120. A user of requestor system 110may access the data analysis reporting tool to specify the type of dataand/or data files that the user would like to have collected from targetsystem 120. The user may also use the tool to specify the resources,file directories and the like of the target system 120 from which therequested data is to be collected.

The same, or another, data analysis and reporting tool may be used by auser of data collection service 130 to view the request received fromrequestor system 110, to create and deploy collector 144 for performingthe collection, and to view the collected data and files once thecollection is completed. For example, a user of data collection service130 may access the data analysis reporting tool to receive the requestfrom requestor 110, review the request to identify a specification ofthe data and files to be collected, create collector 144, and deploycollector 144. User of data collection service 130 may also access thedata analysis and reporting tool to review the data and files collectedfrom target system 120 and to generate reports based on the collecteddata and files.

Optionally, the same or another, data analysis and reporting tool mayalso be available to a user of target system 120 to view a request forcollecting data and files from target system 120, and to view thecollected data and files. User of target system 120 could also use thetool to generate reports based on the collected data and files.

In an embodiment, a data analysis and reporting tool may be implementedas a Web application that may be hosted by a computer server andaccessible to users via hyperlink, which when selected allowsdownloading Web pages onto a user's device. A Web application mayinclude a Web interface 114 and a control manager for providing accessto data and data files stored in target system 120. Web interfaceprovides a Web-based interface, for example one or more Web pages, thatcan be accessed by a user of requestor system 110 via a Web browser. TheWeb-based interface allows a user to specify the types of data and filesto be collected from target system 120, the resources of target system120 to be searched for the requested data and files, the types ofreports requested by requestor 110, and the like.

In an embodiment, a Web application implementing a data analysis andreporting tool may be hosted on any type of a server accessible to theusers of the tool.

In an embodiment, a data analysis and reporting tool is configured togenerate a request for collecting data and files from target system 120.A request may be stored externally to the data analysis and reportingtool, and accessible to the users via one or more communications linksconfigured in a communications network. A request is described in detailin FIG. 1.

In an embodiment, a data analysis and reporting tool is configured tospecify the types of data and files to be collected from target system120 and to specify the resources of target system 120 that are to besearched for the specified data and files. Various ways of specifyingthe data and data files to be collected and the resources of targetsystem 120 from which the data and files are to be collected aredescribed in detail in FIG. 2.

In an embodiment, a data analysis and reporting tool is configured togenerate collector 144 configured to collect data and files from targetsystem 120. A collector is described in detail in FIG. 3.

In an embodiment, a data analysis and reporting tool is configured toaccess data media storing data and to perform the data analysis on thedata stored in the data media. For example, a user of requestor system110 may provide a digital media, such as a computer disk, a compactcomputer disk, a memory storage device, and the like, and request thatcertain data and data files be collected from the media. To facilitatethe collection, it is recommended that the media be write-protected, sothe content of the media may be protected from accidental overwriting ordeleting.

B. Example Workflow

FIG. 13 is a flow diagram that depicts an example approach for dataanalysis and reporting. The example approach depicted in FIG. 13 is tobe viewed as one of many implementations of a data analysis andreporting tool.

In step 1302, a user is prompted to enter preliminary data. Thepreliminary data may include a name of the user, a name of the projectthat the user is working on, a name of the organization or a party forwhom the user requests collection of data and data files from targetsystem 120. Additionally, or alternatively, a user may be prompted toprovide a name of the matter, specify the matter title, and provideother information related to the projection. For example, a user may beasked to define or modify a configuration for collecting the data, oredit a report configuration that may be shown to the user in a pull-outmenu.

If a user is providing an electronic media from which certain data andfiles are to be collected, then the user may be asked to verify whetherthe media is write-protected.

In step 1304, a user is asked to enter additional preliminaryinformation, such as a time zone in which the user is located. Theinformation about the time zone may be used to time stamp thecommunications sent by a data analysis and report tool, and the datareceived by the tool. For example, one time stamp may be included in arequest that a user created to specify the data and data files to becollected, another time stamp may be included in a collector deployed tonetwork storage services 140, other time stamp may be included in areport generated based on the contents of the collected data and datafiles.

In an embodiment, if providing a time zone is not required, or a userfails to provide the time zone information, a data analysis andreporting tool assigns a default information about the time zone ordetermines the time zone for the user. For example, a user may select anoption labeled as “coordinated universal time,” and the tool willdetermine the time zone for the user.

In step 1306, a user is asked to enter data collection options. Datacollection options may include a variety of options that are selectableby the user. For example, a user may be prompted to select one or moretypes of file categories that the user wishes to have collected fromtarget system 120. Non-limiting examples of different types of filecategories are provided in FIGS. 14-15.

FIG. 14 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying file categories 1430. The depicted examples are to be viewedas non-limiting examples of the file categories that a user may selectwhen requesting a collection of data and data files.

The depicted example shows that a user may select one or more of thefollowing file categories: active files, archived files, database files,emails, empty files, encrypted files, file fragments, system files,financial data, files containing a particular font, form data, gamedata, graphics and multimedia data, indexes, Internet files, and thelike. Additional file categories are described in FIG. 15

Upon selecting a particular category from list 1430, the selectedcategory may appear in a text box 1410. A selected category is to beincluded in a request for collecting data and data files from targetsystem 120.

Optionally, a user may add additional description to the selectedcategory by entering the additional description into a text box 1420.

FIG. 15 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying file categories 1530. The depicted example shows that a usermay also select one or more of the following files categories: filescontaining a particular font, form data, game data, graphics andmultimedia data, indexes, Internet files, printer data, a productivitydocument, productivity documents, program data, ROM/RAM image data,shortcut/links, user data, virus data, and the like.

Upon selecting a particular category from list 1530, the selectedcategory may appear in a text box 1510. A selected category is to beincluded in a request for collecting data and data files from targetsystem 120.

Optionally, a user may add additional description to the selectedcategory by entering the additional description into a text box 1520.For example, if a selected file category is “productivity document,”then a user may type into text box 1520 a name of the document that isto be included in the collection.

Data collection options available to a user may also allow a user toselect the data and data files to be collected based on the fileextensions. Various types of ways to select files extensions areprovided in FIG. 16.

FIG. 16 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying file extensions 1630. The depicted example shows that a usermay select one or more of the following file extensions: *.DLT, *.DMD,*.DMF, *.DMG, *.DMP, and the like. The extensions depicted in FIG. 16are not to be viewed as a limited list of possible extensions availableto a user.

Upon selecting a particular file extension from list 1630, the selectedextension may appear in a text box 1610. A selected extension is to beincluded in a request for collecting data and data files from targetsystem 120.

Optionally, a user may add additional description to the selectedextension by entering the additional description into a text box 1620.

Referring again to step 1306 of FIG. 13, a user may also select one ormore system drives (or devices) hosted on target system 120 from which acollection of data and data files is requested. Non-limiting examples ofselecting different drives are depicted in FIG. 17.

FIG. 17 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying computer drives 1730 to be searched. The example userinterface allows a user to select paths in computer drives that are tobe searched for specified data and data files. The depicted drives andpaths shows paths and drives that were available in a testingenvironment, and are to be viewed as merely to illustrate the manner inwhich the paths and drives may be displayed in the interface andselected by the user. For example, if a user selects a particular pathor drive from the list 1730, and then selects a button 1720 labeled witha word “scan,” then the information about the selected path or drive issaved and used by a collector to collect the certain data and datafiles. Furthermore, if a user selects a button “export to CSV” 1710, thedata analysis are reporting tool will scan the selected computerresources and output information about the collected data and data filesto a CSV file. Additional examples are depicted in FIG. 18.

FIG. 18 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying computer drives 1830 to be searched. The example userinterface allows a user to select paths in computer drives that are tobe searched for specified data and data files. The depicted drives andpaths shows paths and drives that were available in a testingenvironment, and are to be viewed as merely to illustrate the manner inwhich the paths and drives may be displayed in the interface andselected by the user. For example, if a user selects a particular pathor drive from the list 1830, and then selects a button 1820 labeled witha word “scan,” then the information about the selected path or drive issaved and used by a collector to collect the certain data and datafiles.

FIG. 19 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal for displayingfile signatures 1920 of files collected according to a specificationprovided by a user. The depicted example shows a list of file signatures1920 of the files that have been collected for a user who requested acollection of data files from a “Recycle Bin,” as indicated using apointer 1930. The depicted example was generated based on a test caseand it is provided to merely illustrate a particular application of thedata analysis and reporting tool.

Referring again to FIG. 13, in step 1308, a user selects report chartoptions. The report chart options may include various options forselecting the format and types of the charts in which the collected dataand data files are to be presented to the user. FIGS. 20-23 depictselecting one or more report chart options.

FIG. 20 depicts an example user interface generated by a data analysisand reporting tool that provides an administrator portal that forspecifying chart types. In the depicted example, a user may select thathe wishes to receive a graphical representation of the collected dataand data files, and/or to receive a report of the collected data anddata files organized either by a category or by a signature of the datafiles. Selection of the graphical representation may also includevarious types of the graphs, including pie charts and bar graphs. Forexample, if a user selected a bar graph option 2010 and a report type bycategory 2020, then the report generated for a user may include agraphical summary of the information about the collected data and datafiles organized by a category and represented as in a bar graph. Exampleof a summary report generated in response to the above selections madeby a user is depicted in FIG. 21.

FIG. 21 depicts an example report generated by a data analysis andreporting tool that shows a summary report 2130 organized by a categoryand represented as a bar chart. To generate a report depicted in FIG.21, a user selects that he wishes to receive a graphical representationof the collected data and data files, and/or to receive a report of thecollected data and data files organized by a category of the data files.The depicted report example shows bars, such as a bar 2110 and a bar2120, which represent counts of the files that have been categorized as“productivity documents,” and “program data,” respectively.

FIG. 22 depicts an example report generated by a data analysis andreporting tool that that provides an administrator portal that forspecifying chart types. In the depicted example, a user may select a piechart option 2040 and a report by a category option 2020, or a report bya signature option 2030. Examples of a summary reports generated inresponse to the above selection made by a user is depicted in FIGS.23-24.

FIG. 23 depicts an example report generated by a data analysis andreporting tool that shows a summary report 2350 organized by a filecount per category and represented as a pie chart. The depicted examplewas generated based on a particular set of data collected from aparticular computer resources. In the depicted example, a pie chartsummary report 2350 contains four sections. The first sectioncorresponds to productivity documents 2310; the section corresponds toprogram data 2320; the third section corresponds to graphics andmultimedia documents 2330; and the fourth section corresponds to userdata 2340. In the depicted example, the first section corresponding toproductivity documents 2310 constituted about 35.29% of all collecteddocuments; the second section corresponding to program data 2320constituted about 29.41% of all collected documents; the third sectioncorresponding to graphics and multimedia documents 2330 constitutedabout 11.76% of all collected documents; and the fourth sectioncorresponding to user data 2340 constituted about 23.53% of alldocuments.

FIG. 24 depicts an example report generated by a data analysis andreporting tool that shows a summary report organized by a file size percategory and represented as a pie chart. The depicted example wasgenerated based on a particular set of data collected from a particularcomputer resources. In the depicted example, a pie chart summary report2450 contains four sections. The first section corresponds toproductivity documents 2410; the section corresponds to program data2420; the third section corresponds to graphics and multimedia documents2430; and the fourth section corresponds to user data 2440. In thedepicted example, the first section corresponding to productivitydocuments 2410 constituted about 26.87% of all collected documents; thesecond section corresponding to program data 2420 constituted about6.64% of all collected documents; the third section corresponding tographics and multimedia documents 2430 constituted about 65.60% of allcollected documents; and the fourth section corresponding to user data2440 constituted about 0.89% of all documents.

According to another example, a user may select a report by a signatureoption 2030. An example of a summary reports generated in response tothe above selection made by a user is depicted in FIG. 25.

FIG. 25 depicts an example report generated by a data analysis andreporting tool that shows a summary report organized by a signature. Inthe depicted example, summary report 2550 has been generated fromcollected data and data files and organized by a file signature embeddedin the respective files. Benefits of relying on file signatures embeddedin the files, instead of relying merely on file extensions included inthe names of the files, are described above.

In the depicted example summary report 2550, a first column identifiesfile signatures, such as a signature for *.ASD 2510, a signature for*.DOC 2520, a signature *.INI 2530, a signature *.JPG 2540, and thelike. For each signature type, summary report 2550 shows the name of therespective file category, the count of files within each category, filesizes in bytes, file sized in megabytes, and the like.

Referring again to FIG. 13, in step 1310, a user may select whether alog for a collector is to be created as the collector is executed. A logmay be desirable when a collection of data and data files is complex andthere is a probability that a collector may generate information usefulto validate the correctness of the collection. A log may be reviewed byusers of requestor 110 and/or users of data collection service 130 tovalidate the search results, information about the collected data anddata files, and troubleshoot settings for a collector if the collecteddata and data files do not meet the expectations of requestor 110 anddata collection service 130.

In step 1312, data analysis and reporting tool 1300 creates and deploysa collector. Various ways of creating and deploying a collector aredescribed in FIGS. 7-8.

In an embodiment, information provided or selected by a user is used togenerate collection definition data, also referred to as a collectionspecification. Collection definition data may include specifications ofthe types of data to be collected, specifications of the resources fromwhich the data is to be collected, specifications of the destinations atwhich the collected data is to be stored, specification of the types ofreports that are requested, and the like.

In an embodiment, data analysis and reporting tool 1300 creates anddeploys a collector that is configured to collect data and data filesare requested by a user. More specifically, if data analysis andreporting tool 1300 is used by a user of a data collection service, thenthe tool uses the collection definition data to generate a collector,and deploys the collector for performing the collection of the data andfiles. However, if the data analysis and reporting tool is used by auser of requestor system 110, then the tool either uses the collectiondefinition data to generate and deploy a collector or communicates thecollection definition data to data collection service 130 for datacollection service 130 to generate and deploy a collector.

In step 1314, data analysis and reporting tool 1300 receives anindication that a collector completed collecting data and data filesfrom target system 120, and allows a user to select export options forexporting reports generated based on the collected data. This step mayalso be performed concurrently with step 1306, as a selection of theexport option may be performed prior to deployment of a collector.

Reports generated based on the collected data and data files may beexported using different data formats. For example, a report may beformatted in accordance with the CSV format, described above.

In an embodiment, a user selects an option for exporting reports in theCSV format. This may be accomplished when the user selects an optionbutton 1710 depicted in FIG. 17.

In step 1316, upon selecting for example, option button 1710 depicted inFIG. 17, the system generates a data structure (also referred to as acontainer) that is compatible with the CSV format, places the recordscontaining the report data into the container, and exports a CSV file inthe CSV format to a recipient or a requestor.

In an embodiment, records or fields of a CSV-compatible container may beseparated by a comma or any other separator. An example of a hardcopy ofa report exported in the CSV format is depicted in FIG. 26.

FIG. 26 depicts an example report generated by a data analysis andreporting tool that shows a comma-separated-values (CSV) file. Thedepicted example shows one of many ways of representing report data inthe CSV data file. In the depicted example, record data are separated bya comma, and each record has the same count of fields. The count offields may depend of the implementation of the data analysis andreporting tool. The contents of the records may depend on the resultsdelivered by the data analysis and collection tool

In the depicted example, a CSV file contains eighteen records (rows) ofdata; however, the count of the records and the contents of the recordsmay vary and depend on the implementation of the tool and the resultsprovided by the tool.

In an embodiment, each row in a CSV file contains a plurality of fields.Non-limiting examples of some fields include a file name field 2610, afile extension field 2620, a file signature field 2630, a file typefield 2640, a file size field 2650, a file creation date field 2660, andthe like. Data of each record in the CSV files are stored in the fieldsas depicted in FIG. 26. Other methods of organizing a CSV file may alsobe implemented. Furthermore, other methods of exporting reportinformation about the collected data and the data files may also beimplemented.

In an embodiment, collected data and data files are exported to arequestor and/or a recipient. For example, the collected data and datafiles may be exported to a user of requestor 110 and/or a user of datacollection service 130.

In step 1318, data analysis and reporting tool 1300 generates anotification to a requestor and/or to data collection service 130. Forexample, data analysis and reporting tool 1300 may generate anelectronic message to notify a user of requestor 110 to indicate thatthe requested data and data files have been collected and stored innetwork storage services 140. The electronic message may also indicateto the user a location at which the collected data and data files havebeen stored and may indicate that reports are ready and available toreview by the user.

Additionally, or alternatively, data analysis and reporting tool 1300may display the reports that the user requested. For example, dataanalysis and reporting tool 1300 may automatically display one or morereport requested by the user as soon as the collection of the requesteddata and data files from computer resources of target system 120 iscompleted. Examples of various reports generated based on the collecteddata and data files are described in FIG. 21 and FIGS. 23-25.

In an embodiment, data analysis and reporting tool 1300 also generates anotification to a user of data collection service 130 to notify the userthat that the requested data and data files have been collected andstored in network storage services 140. The electronic message may alsoindicate to the user a location at which the collected data and datafiles have been stored and may indicate that reports are ready andavailable to review by the user. Furthermore, the electronic message mayindicate that reports requested by the user are available.Alternatively, the reports may be available to the user and displayedfor the user automatically once the collection of the requested data anddata files is completed.

In an embodiment, an approach is presented for collecting electronicdata and data files from target systems for the purpose of performingany type of data discovery, including legal discovery, audit requests,and the like. For example, in some cases the electronic data and datafiles may be collected from target systems when the data is requestedfor legal discovery purposes; in some other cases, the data may becollected when the data is requested for corporate and individual auditpurposes, including audits instigated by governmental agencies.Collecting of the electronic data and data files is performed in aselective manner, which allows collecting only the requested data anddata files, not all data from computer resources from target devices.

The approach also allows storing the collected data and data files inany network storage system, including cloud systems hosted in adistributed network of servers.

Furthermore, the approach allows performing legal discovery preservingthe integrity and security of the collected data. For example, theapproach allows performing the data collection independently and withoutan actual involvement of the interested party.

Moreover, the approach may be implemented in a system that can beaccessed automatically or by individuals who do not need to demonstrateany specialized knowledge and experience in performing legal discovery.

In an embodiment, a data analysis and reporting tool is presented thatallows generating a variety of reports based on the collected data anddata files, and that allows customizing the reports in a variety ofways. The broad capabilities of the tool leads to providing a user witha satisfactory user experience and confidence about the integrity andsecurity of the collected data.

VII. IMPLEMENTATION MECHANISMS

Although the flow diagrams of the present application depict aparticular set of steps in a particular order, other implementations mayuse fewer or more steps, in the same or different order, than thosedepicted in the figures.

According to one embodiment, the techniques described herein areimplemented by one or more special-purpose computing devices. Thespecial-purpose computing devices may be hard-wired to perform thetechniques, or may include digital electronic devices such as one ormore application-specific integrated circuits (ASICs) or fieldprogrammable gate arrays (FPGAs) that are persistently programmed toperform the techniques, or may include one or more general purposehardware processors programmed to perform the techniques pursuant toprogram instructions in firmware, memory, other storage, or acombination. Such special-purpose computing devices may also combinecustom hard-wired logic, ASICs, or FPGAs with custom programming toaccomplish the techniques. The special-purpose computing devices may bedesktop computer systems, portable computer systems, handheld devices,networking devices or any other device that incorporates hard-wiredand/or program logic to implement the techniques.

FIG. 27 is a block diagram that depicts an example computer system 2700upon which embodiments may be implemented. Computer system 2700 includesa bus 2702 or other communication mechanism for communicatinginformation, and a processor 2704 coupled with bus 2702 for processinginformation. Computer system 2700 also includes a main memory 2706, suchas a random access memory (RAM) or other dynamic storage device, coupledto bus 2702 for storing information and instructions to be executed byprocessor 2704. Main memory 2706 also may be used for storing temporaryvariables or other intermediate information during execution ofinstructions to be executed by processor 2704. Computer system 2700further includes a read only memory (ROM) 2708 or other static storagedevice coupled to bus 2702 for storing static information andinstructions for processor 2704. A storage device 2710, such as amagnetic disk or optical disk, is provided and coupled to bus 2702 forstoring information and instructions.

Computer system 2700 may be coupled via bus 2702 to a display 2712, suchas a cathode ray tube (CRT), for displaying information to a computeruser. Although bus 2702 is illustrated as a single bus, bus 2702 maycomprise one or more buses. For example, bus 2702 may include withoutlimitation a control bus by which processor 2704 controls other deviceswithin computer system 2700, an address bus by which processor 2704specifies memory locations of instructions for execution, or any othertype of bus for transferring data or signals between components ofcomputer system 2700.

An input device 2714, including alphanumeric and other keys, is coupledto bus 2702 for communicating information and command selections toprocessor 2704. Another type of user input device is cursor control2716, such as a mouse, a trackball, or cursor direction keys forcommunicating direction information and command selections to processor2704 and for controlling cursor movement on display 2712. This inputdevice typically has two degrees of freedom in two axes, a first axis(e.g., x) and a second axis (e.g., y), that allows the device to specifypositions in a plane.

Computer system 2700 may implement the techniques described herein usingcustomized hard-wired logic, one or more ASICs or FPGAs, firmware and/orprogram logic or computer software which, in combination with thecomputer system, causes or programs computer system 2700 to be aspecial-purpose machine. According to one embodiment, those techniquesare performed by computer system 2700 in response to processor 2704executing one or more sequences of one or more instructions contained inmain memory 2706. Such instructions may be read into main memory 2706from another computer-readable medium, such as storage device 2710.Execution of the sequences of instructions contained in main memory 2706causes processor 2704 to perform the process steps described herein. Inalternative embodiments, hard-wired circuitry may be used in place of orin combination with software instructions to implement the embodiments.Thus, embodiments are not limited to any specific combination ofhardware circuitry and software.

The term “computer-readable medium” as used herein refers to any mediumthat participates in providing data that causes a computer to operate ina specific manner. In an embodiment implemented using computer system2700, various computer-readable media are involved, for example, inproviding instructions to processor 2704 for execution. Such a mediummay take many forms, including but not limited to, non-volatile mediaand volatile media. Non-volatile media includes, for example, optical ormagnetic disks, such as storage device 2710. Volatile media includesdynamic memory, such as main memory 2706. Common forms ofcomputer-readable media include, for example, a floppy disk, a flexibledisk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM,any other optical medium, a RAM, a PROM, and EPROM, a FLASH-EPROM, anyother memory chip or memory cartridge, or any other medium from which acomputer can read.

Various forms of computer-readable media may be involved in carrying oneor more sequences of one or more instructions to processor 2704 forexecution. For example, the instructions may initially be carried on amagnetic disk of a remote computer. The remote computer can load theinstructions into its dynamic memory and send the instructions over atelephone line using a modem. A modem local to computer system 2700 canreceive the data on the telephone line and use an infra-red transmitterto convert the data to an infra-red signal. An infra-red detector canreceive the data carried in the infra-red signal and appropriatecircuitry can place the data on bus 2702. Bus 2702 carries the data tomain memory 2706, from which processor 2704 retrieves and executes theinstructions. The instructions received by main memory 2706 mayoptionally be stored on storage device 2710 either before or afterexecution by processor 2704.

Computer system 2700 also includes a communication interface 2718coupled to bus 2702. Communication interface 2718 provides a two-waydata communication coupling to a network link 2720 that is connected toa local network 2722. For example, communication interface 2718 may bean integrated services digital network (ISDN) card or a modem to providea data communication connection to a corresponding type of telephoneline. As another example, communication interface 2718 may be a localarea network (LAN) card to provide a data communication connection to acompatible LAN. Wireless links may also be implemented. In any suchimplementation, communication interface 2718 sends and receiveselectrical, electromagnetic or optical signals that carry digital datastreams representing various types of information.

Network link 2720 typically provides data communication through one ormore networks to other data devices. For example, network link 2720 mayprovide a connection through local network 2722 to a host computer 2724or to data equipment operated by an Internet Service Provider (ISP)2726. ISP 2726 in turn provides data communication services through theworld wide packet data communication network now commonly referred to asthe “Internet” 2728. Local network 2722 and Internet 2728 both useelectrical, electromagnetic or optical signals that carry digital datastreams.

Computer system 2700 can send messages and receive data, includingprogram code, through the network(s), network link 2720 andcommunication interface 2718. In the Internet example, a server 2730might transmit a requested code for an application program throughInternet 2728, ISP 2726, local network 2722 and communication interface2718. The received code may be executed by processor 2704 as it isreceived, and/or stored in storage device 2710, or other non-volatilestorage for later execution.

In the foregoing specification, embodiments have been described withreference to numerous specific details that may vary from implementationto implementation. Thus, the sole and exclusive indicator of what is,and is intended by the applicants to be, the approach is the set ofclaims that issue from this application, in the specific form in whichsuch claims issue, including any subsequent correction. Hence, nolimitation, element, property, feature, advantage or attribute that isnot expressly recited in a claim should limit the scope of such claim inany way. The specification and drawings are, accordingly, to be regardedin an illustrative rather than a restrictive sense.

What is claimed is:
 1. One or more non-transitory computer-readablestorage media storing instructions which, when processed by one or moreprocessors, cause: a mobile data collection manager generating acollector based, at least in part, on collection definition data;wherein the mobile data collection manager is implemented in a mobiledevice; wherein the collector is configured to perform a data search ona target device; the mobile data collection manager causing to transmitthe collector to a network server for storing the collector in thenetwork server; and the mobile data collection manager generating, andcausing to be transmitted to the network server, a notification fornotifying a custodian of the target device that the collector is to bedownloaded from the network server to the target device for execution onthe target device; wherein executing the collector on the target devicecauses the collector to: selectively determine one or more data filesthat have certain characteristics and that are hosted on the targetdevice; collect the one or more data files from the target device; andstore the one or more data files in the network server.
 2. The one ormore non-transitory computer-readable storage media of claim 1, whereinthe certain characteristics of the one or more data files are determinedbased on contents of one or more of: a signature of a file included inthe file, a digital certificate of the file included in the file, aunique code of the file embedded in the file; and wherein the collectorrelies on the certain characteristics to select and collect the one ormore data files from the target device.
 3. The one or morenon-transitory computer-readable storage media of claim 1, wherein theone or more data files to by collected from the target device areselected based on file signatures embedded in the one or more datafiles.
 4. The one or more non-transitory computer-readable storage mediaof claim 1, wherein upon receiving the notification from the mobile datacollection manager , the custodian of the target device downloads thecollector from the network server to the target device for the executionon the target device; and wherein upon completing executing of thecollector on the target device, the collector generates, and causestransmitting to the mobile data collection manager , an electronicmessage indicating that the one or more data files have been collectedand stored on the network server.
 5. The one or more non-transitorycomputer-readable storage media of claim 1, wherein the collectiondefinition data is used by the data collection manager to specify one ormore of: one or more file types of the one or more data files to besearched, one or more sources to be searched, one or more attachments tobe searched, one or more legal forms to be attached, storage types to beused, storage location for storing data, user credentials, groupcredentials, time constrains, types of processing the data, types ofmodifications, types of communications exchanged with the custodian andthe mobile data collection manager , email addresses of the custodianand one or more users, types of notifications, or error handlingprocedures.
 6. The one or more computer-readable storage media of claim1, wherein storing the one or more data files in the network servercomprises including the one or more data files in one or more containersand transmitting the one or more containers to the network server. 7.The one or more computer-readable storage media of claim 1, wherein theexecuting of the collector on the target device further causes thecollector to perform: generating one or more logs containing informationabout collecting the one or more data files; and transmitting to thenetwork server the one or more logs to be stored on the network server.8. A method for collecting data and data files from computer resourcesof a target system for a computerized legal discovery, the methodexecuted by a mobile data collection manager implemented in a mobiledevice and comprising: generating a collector based, at least in part,on collection definition data; wherein the collector is configured toperform a data search on a target device; causing to transmit thecollector to a network server for storing the collector in the networkserver; and generating, and causing to be transmitted to the networkserver, a notification for notifying a custodian of the target devicethat the collector is to be downloaded from the network server to thetarget device for execution on the target device; wherein executing thecollector on the target device causes the collector to: selectivelydetermine one or more data files that have certain characteristics andthat are hosted on the target device; collect the one or more data filesfrom the target device; and store the one or more data files in thenetwork server.
 9. The method of claim 8, wherein the certaincharacteristics of the one or more data files are determined based oncontents of one or more of: a signature of a file included in the file,a digital certificate of the file included in the file, a unique code ofthe file embedded in the file; and wherein the collector relies on thecertain characteristics to select and collect the one or more data filesfrom the target device.
 10. The method of claim 8, wherein the one ormore data files to by collected from the target device are selectedbased on file signatures embedded in the one or more data files.
 11. Themethod of claim 8, wherein upon receiving the notification from themobile data collection manager , the custodian of the target devicedownloads the collector from the network server to the target device forthe execution on the target device; and wherein upon completingexecuting of the collector on the target device, the collectorgenerates, and causes transmitting to the mobile data collection manager, an electronic message indicating that the one or more data files havebeen collected and stored on the network server.
 12. The method of claim8, wherein the collection definition data is used by the data collectionmanager to specify one or more of: one or more file types of the one ormore data files to be searched, one or more sources to be searched, oneor more attachments to be searched, one or more legal forms to beattached, storage types to be used, storage location for storing data,user credentials, group credentials, time constrains, types ofprocessing the data, types of modifications, types of communicationsexchanged with the custodian and the mobile data collection manager ,email addresses of the custodian and one or more users, types ofnotifications, or error handling procedures.
 13. The method of claim 8,wherein storing the one or more data files in the network servercomprises including the one or more data files in one or more containersand transmitting the one or more containers to the network server. 14.The method of claim 8, wherein the executing of the collector on thetarget device further causes the collector to perform: generating one ormore logs containing information about collecting the one or more datafiles; and transmitting to the network server the one or more logs to bestored on the network server.
 15. A computer-implemented legal discoverysystem comprising: a collector configured to perform a computerizedlegal discovery; a mobile data collection manager implemented in amobile device and configured to: generating a collector based, at leastin part, on collection definition data; wherein the collector isconfigured to perform a data search on a target device; causing totransmit the collector to a network server for storing the collector inthe network server; and generating, and causing to be transmitted to thenetwork server, a notification for notifying a custodian of the targetdevice that the collector is to be downloaded from the network server tothe target device for execution on the target device; wherein executingthe collector on the target device causes the collector to: selectivelydetermine one or more data files that have certain characteristics andthat are hosted on the target device; collect the one or more data filesfrom the target device; and store the one or more data files in thenetwork server.
 16. The computer-implemented legal discovery system ofclaim 15, wherein the certain characteristics of the one or more datafiles are determined based on contents of one or more of: a signature ofa file included in the file, a digital certificate of the file includedin the file, a unique code of the file embedded in the file; and whereinthe collector relies on the certain characteristics to select andcollect the one or more data files from the target device.
 17. Thecomputer-implemented legal discovery system of claim 15, wherein the oneor more data files to by collected from the target device are selectedbased on file signatures embedded in the one or more data files.
 18. Thecomputer-implemented legal discovery system of claim 15, wherein uponreceiving the notification from the mobile data collection manager , thecustodian of the target device downloads the collector from the networkserver to the target device for the execution on the target device; andwherein upon completing executing of the collector on the target device,the collector generates, and causes transmitting to the mobile datacollection manager , an electronic message indicating that the one ormore data files have been collected and stored on the network server.19. The computer-implemented legal discovery system of claim 15, whereinthe collection definition data is used by the data collection manager tospecify one or more of: one or more file types of the one or more datafiles to be searched, one or more sources to be searched, one or moreattachments to be searched, one or more legal forms to be attached,storage types to be used, storage location for storing data, usercredentials, group credentials, time constrains, types of processing thedata, types of modifications, types of communications exchanged with thecustodian and the mobile data collection manager , email addresses ofthe custodian and one or more users, types of notifications, or errorhandling procedures.
 20. The computer-implemented legal discovery systemof claim 15, wherein storing the one or more data files in the networkserver comprises including the one or more data files in one or morecontainers and transmitting the one or more containers to the networkserver.